CVE-2022-26923: high-severity vulnerability in Microsoft Windows 10 Version 1507
Active Directory Domain Services Elevation of Privilege Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Patch now. It under exploitation confirmed by CISA and has a working public exploit.
Apply updates per vendor instructions.
A flaw in Active Directory Domain Services allows attackers to escalate their privileges and gain higher-level access without proper authorization. This is dangerous because it lets an attacker who already has some access to a network take complete control of critical systems.
An elevation of privilege vulnerability in AD DS exploits improper certificate validation (CWE-295), allowing an authenticated network attacker to escalate privileges within the domain. The vulnerability requires an attacker with existing domain user access; successful exploitation grants administrative or system-level privileges, compromising domain security and enabling lateral movement and data exfiltration.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.